Shubham Srivastava 7da9b26363 fix(dashboard): escape model id in hx-vals to prevent injection/XSS (#73) ...

The model id is interpolated into the single-quoted hx-vals attribute. A
crafted id (reachable as an `active` model from any /v1/messages request on
the unauthenticated localhost dashboard) could break out of the JSON or the
attribute itself. Build valid JSON via JSON.stringify, then escapeHtml the
whole attribute value; the browser decodes the entities before htmx reads it,
so well-formed ids are unaffected. Closes #58.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-16 13:32:38 -04:00

..

fixtures

chore: rename all pixelpipe references to pxpipe

2026-06-09 19:04:09 -04:00

anthropic-cache-align.test.ts

fix(transform): drop scope:"global" from relocated cache_control markers

2026-07-16 13:00:46 -04:00

baseline.test.ts

fix(savings): use observed cache state for text baseline

2026-06-30 12:24:09 -04:00

cache-stability-e2e.test.ts

fix: diff-based static/volatile env split replaces blanket relocation

2026-07-13 15:46:07 -04:00

context-map.test.ts

fix(savings): use observed cache state for text baseline

2026-06-30 12:24:09 -04:00

dashboard-api.test.ts

feat: add Sol Messages bridge and history compression

2026-07-15 15:15:58 -04:00

design-behavior-e2e.test.ts

feat(profile): use 5x8 rendering for opt-in Sol

2026-07-11 18:22:46 -04:00

docs-integrity.test.ts

test(docs): recursive link + heading-anchor integrity check

2026-07-04 22:57:55 -04:00

env-split.test.ts

fix: diff-based static/volatile env split replaces blanket relocation

2026-07-13 15:46:07 -04:00

export-collect.test.ts

fix(export): apply include/exclude and size limit to --git untracked files

2026-07-04 19:06:35 -04:00

export-git-e2e.test.ts

test(export): end-to-end --git untracked filtering in a real git repo

2026-07-04 19:06:35 -04:00

export-proxy-align.test.ts

feat(export): replace in-band @pxpipe directive with explicit pxpipe export CLI

2026-06-27 18:28:28 -04:00

export.test.ts

feat: Grok packing + IDS, keep Fable-only default, honest chart

2026-07-10 23:50:37 -04:00

factsheet.test.ts

feat: add Sol Messages bridge and history compression

2026-07-15 15:15:58 -04:00

gate-flap.test.ts

fix(gate): content-aware image cost + width-shrinking (WIP tests)

2026-05-23 21:26:36 -04:00

gateway.test.ts

feat: cache-stable history-collapse imaging for GPT (OpenAI) + Anthropic

2026-06-20 21:11:24 -04:00

gpt-cache-align.test.ts

feat: cache-stable history-collapse imaging for GPT (OpenAI) + Anthropic

2026-06-20 21:11:24 -04:00

hero.test.ts

feat: cache-stable history-collapse imaging for GPT (OpenAI) + Anthropic

2026-06-20 21:11:24 -04:00

history.test.ts

fix(openai): price and gate Responses traffic by model, not path

2026-07-09 12:44:03 -04:00

keep-sharp.test.ts

feat(library): caller fidelity + recoverable channel, edge-safe; trim comments

2026-06-19 13:02:30 -04:00

models-fragment-escape.test.ts

fix(dashboard): escape model id in hx-vals to prevent injection/XSS (#73)

2026-07-16 13:32:38 -04:00

openai-gpt5.test.ts

feat: add Sol Messages bridge and history compression

2026-07-15 15:15:58 -04:00

openai-history.test.ts

feat: add Sol Messages bridge and history compression

2026-07-15 15:15:58 -04:00

paging.test.ts

fix(openai): price and gate Responses traffic by model, not path

2026-07-09 12:44:03 -04:00

proxy-usage.test.ts

fix(proxy): stop persisting 4xx request bodies by default (privacy) (#74)

2026-07-16 13:30:09 -04:00

public-api.test.ts

fix(anthropic): preserve Claude Code OAuth identity

2026-07-16 12:12:18 -04:00

readme-offline-export.test.ts

docs: document offline export workflow (#79)

2026-07-16 13:25:07 -04:00

recoverable.test.ts

feat(library): caller fidelity + recoverable channel, edge-safe; trim comments

2026-06-19 13:02:30 -04:00

reflow.test.ts

test: cap corpus L0 test to an 8MB per-file prefix

2026-06-17 10:44:46 -04:00

render.test.ts

fix: pass native typed tools through untouched (#43) (#113)

2026-07-16 13:16:06 -04:00

restart-restore.test.ts

feat: cache-stable history-collapse imaging for GPT (OpenAI) + Anthropic

2026-06-20 21:11:24 -04:00

restart.test.sh

chore: rename all pixelpipe references to pxpipe

2026-06-09 19:04:09 -04:00

savings-honesty.test.ts

feat: add model-specific render profiles and recall evidence

2026-07-09 22:25:06 -04:00

savings-math-e2e.test.ts

feat: add Sol Messages bridge and history compression

2026-07-15 15:15:58 -04:00

sessions.test.ts

fix(savings): use observed cache state for text baseline

2026-06-30 12:24:09 -04:00

stats.test.ts

chore: rename all pixelpipe references to pxpipe

2026-06-09 19:04:09 -04:00

tracker.test.ts

feat: add Sol Messages bridge and history compression

2026-07-15 15:15:58 -04:00